All vulnerabilities
CVE-2026-118687GHSA-24vh-q7rg-243w

Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication

coder coder
Open in ThreatlineRecord JSON
CVSS
8.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2.37.4Also 2.36.7, 2.35.9 and 2 moreCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.

Text from CVE List

Affected versions 10

  • coderaffected: 2.37.0 before 2.37.4CVE List
  • coderunaffected: 2.37.4CVE List
  • coderaffected: 2.36.0 before 2.36.7CVE List
  • coderunaffected: 2.36.7CVE List
  • coderaffected: 2.35.0 before 2.35.9CVE List
  • coderunaffected: 2.35.9CVE List
  • coderaffected: 2.30.0 before 2.34.12CVE List
  • coderunaffected: 2.34.12CVE List
  • coderaffected: all versions before 2.29.21CVE List
  • coderunaffected: 2.29.21CVE List

References 2